ClawHub
Back to skill

Security audit

payaion-transfer

Security checks across malware telemetry and agentic risk

Overview

This skill clearly uploads user-selected files to Payaion and can create paid marketplace listings, which is sensitive but disclosed and aligned with its stated purpose.

Install only if you intend to use Payaion for file transfer or marketplace listing. Before each upload, verify the exact file or URL, whether it will be publicly listed, and any USDC per-download price; avoid sensitive directories unless you explicitly approve that upload.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
## One-Shot API (recommended — single request does everything)

Upload + wait for ready + set price + list on marketplace — all in ONE curl call. The server handles polling internally and returns the final result.

### Upload a local file with pricing and marketplace listing
Confidence
95% confidence
Finding
curl call. The server handles polling internally and returns the final result. ### Upload a local file with pricing and marketplace listing ```bash curl -s -X POST https://payaion-api.fly.dev/v1/aio

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.